Polymarket Loses ~$2.7M in Attack on Third-Party Script, Vows Full Refunds

A security breach on Thursday, October 29, drained approximately $2.7 million from more than 700 accounts on the prediction market platform Polymarket. The attack exploited a compromised third-party script, prompting a temporary shutdown of the site's international operations.

Blockchain analytics firm Bubblemaps estimated that around 700 users were affected by the incident. Polymarket has not yet confirmed the exact number of impacted accounts or the precise amount lost, but the company has publicly committed to reimbursing all victims in full.

The platform was taken offline briefly following the discovery of the breach, likely to contain the damage and investigate the source of the compromise. The attack targeted the third-party script, which is an external code integrated into the site's functionality, rather than Polymarket's core infrastructure.

Polymarket, a decentralized betting exchange that allows users to wager on the outcomes of real-world events, has not disclosed further details about the specific script involved or the identity of the attackers. The company's pledge to refund affected users aims to restore confidence among its trader community.

This incident adds to a growing list of security challenges faced by crypto-based platforms, highlighting the risks associated with third-party dependencies. Users are advised to monitor their accounts and exercise caution with external integrations while the investigation continues.